100 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
justme	15f159ab39	ci: raise WSL runner PID budget for NativeAOT [CI]	2026-10-10 06:03:44 -07:00
justme	010576bc2a	ci: document cached Buildah network helpers [CI]	2026-10-10 05:57:43 -07:00
justme	c2ab9eab3b	ci: install Buildah network helpers in runner [CI]	2026-10-10 05:53:01 -07:00
justme	a77f12545b	ci: initialize isolated Buildah auth files [CI]	2026-10-10 05:51:13 -07:00
justme	9919de53d3	ci: keep WSL agent online for pipelines [CI]	2026-10-10 05:48:48 -07:00
justme	1975253beb	ci: bake cached toolchain into Podman agent and fix nested Buildah [CI]	2026-10-10 05:44:21 -07:00
justme	2e1dbcf4ce	ci: use cache path for NuGet scratch [CI]	2026-10-10 04:40:09 -07:00
justme	a1101424d2	ci: add .NET 10 NativeAOT AotAnywhere builder [CI]	2026-10-10 04:36:47 -07:00
justme	0d08e90dab	perf(tests): isolate network E2E and await QUIC cleanup	2026-10-10 19:33:36 +08:00
justme	047df83a84	ci: queue fresh dev image pipeline [CI] [SKIP TESTS] ... Signed-off-by: JustMe <mr.toing@outlook.com>	2026-10-10 19:05:23 +08:00
justme	145660f0a2	ci: retrigger dev image pipeline [CI] [SKIP TESTS] ... Signed-off-by: JustMe <mr.toing@outlook.com>	2026-10-10 19:03:13 +08:00
justme	a1b8af8509	ci: bound and cancel Buildah commands [CI] [SKIP TESTS] ... Signed-off-by: JustMe <mr.toing@outlook.com>	2026-10-10 17:30:55 +08:00
justme	a3b9671d62	ci: rotate Buildah storage after cache mount failure [CI] [SKIP TESTS] ... Signed-off-by: JustMe <mr.toing@outlook.com>	2026-10-10 16:43:42 +08:00
justme	e49e701a73	ci: restore Zig toolset for clean AOT builds [CI] [SKIP TESTS] ... Signed-off-by: JustMe <mr.toing@outlook.com>	2026-10-10 16:32:04 +08:00
justme	7512ae0f00	ci: build ARM64 dev images with AotAnywhere [CI] [SKIP TESTS] ... Signed-off-by: JustMe <mr.toing@outlook.com>	2026-10-10 16:16:17 +08:00
justme	da353d239a	ci: isolate caches and trust ARM Alpine keys [CI] [SKIP TESTS] ... Signed-off-by: JustMe <mr.toing@outlook.com>	2026-10-10 15:51:10 +08:00
justme	49812e94c0	ci: cross-build dev images with AotAnywhere [CI] [SKIP TESTS] ... Signed-off-by: JustMe <mr.toing@outlook.com>	2026-10-10 15:45:45 +08:00
justme	376020fe34	fix(ci): isolate per-arch node build workspaces [CI] [SKIP TESTS]	2026-10-10 15:27:55 +08:00
justme	d9938e4b96	ci: build node ARM64 images in parallel [CI] [SKIP TESTS]	2026-10-10 15:22:23 +08:00
justme	8b3abd5b22	feat(ci): publish ARM64 development node images [CI] [SKIP TESTS]	2026-10-10 15:19:30 +08:00
justme	32507fcb4d	docs(protocol): document stopping and Probe retries [CI] [SKIP TESTS]	2026-10-10 14:40:30 +08:00
justme	85c2043f2f	feat(display): explain QUIC state and compact panels [CI]	2026-10-10 14:17:43 +08:00
justme	efb50d0efe	feat(admin): show Probe status and retry links	2026-10-10 14:17:19 +08:00
justme	97ab3cc740	feat(runtime): track node lifecycle and QUIC link state	2026-10-10 14:16:57 +08:00
justme	238046d959	test(backend): parallelize isolated fixtures [CI] [SKIP TESTS]	2026-10-10 04:54:18 +08:00
justme	77d8404f59	ci(test): load MsQuic for Linux tests [CI]	2026-10-10 04:11:55 +08:00
justme	29d998bc94	build(quic): bundle Linux runtime libraries [CI]	2026-10-10 04:01:24 +08:00
justme	e2e5e437cb	docs(deploy): document QUIC runtime and port requirements [CI]	2026-10-10 03:00:47 +08:00
justme	b25b111134	feat(display): add compact QUIC and host health views	2026-10-10 03:00:23 +08:00
justme	b964dc2bbc	feat(quic): replace probe UDP data plane with QUIC datagrams	2026-10-10 02:59:56 +08:00
justme	4609048865	docs: merge the API guidelines into api.md; drop the one-off trial reports; fix the node-update description (Quadlet restart vs host updater); tidy TODO [CI]	2026-10-09 22:31:11 +08:00
justme	900bbde46a	ci: run the slow e2e tests after the image builds (a parallel run got the backend AOT compile OOM-killed)	2026-10-09 15:24:07 +08:00
justme	2d31bd091e	ci: gate on the fast tests (about 20s); slow end-to-end tests run in parallel with the image build [CI]	2026-10-09 14:33:03 +08:00
justme	c9c21f8056	ci: fix the failed-test retry (wildcard filter, ignore zero-test exit code, two attempts) [CI]	2026-10-09 14:09:54 +08:00
justme	b2b63c065d	ci: sync packaging and docs into the test cache; retry failed tests once [CI]	2026-10-09 14:02:42 +08:00
justme	0873acf66a	fix(link): ride out short path blackouts: 30s handshake, 180s idle limit, 90s keepalive, faster probe reconnect [CI]	2026-10-09 13:46:59 +08:00
justme	be04045c8c	ci: incremental backend tests, cached web dependencies, web build in parallel with the tests	2026-10-09 13:39:55 +08:00
justme	006814823b	docs: main-only workflow, CI-filled versions, dev version format [CI]	2026-10-09 13:20:30 +08:00
justme	7ff0d0f4e6	feat: print build info at startup; version placeholders filled in by CI [CI SKIP]	2026-10-09 13:20:30 +08:00
justme	a9f78f99df	ci: version from the tag or the commits since it; dev images from main gated on tests; recognise -dev. tags [CI SKIP]	2026-10-09 13:20:30 +08:00
justme	a3338e1cf3	fix(display): background quality as a three-way choice (blurred, sharp, original) [CI]	2026-10-09 04:57:01 +08:00
justme	044ce0c339	feat(display): background photo groups with blurred, compressed and original versions; veil, sway and blur options in the appearance panel [CI]	2026-10-09 04:50:11 +08:00
justme	725fe17a7d	chore: release 0.4.0 [CI]	2026-10-09 03:54:56 +08:00
justme	e49990776b	feat(display): falling snow in three depth layers with wind, mouse and bullet time; appearance panel; dark glass tinted from the background [CI SKIP]	2026-10-09 03:54:49 +08:00
justme	f8e8bb8acb	feat(display): pointer-sway background with a dark variant; acrylic glass tokens [CI]	2026-10-09 03:09:14 +08:00
justme	70f20d38d0	feat(display): site name and avatar in the top bar, content aligned left [CI SKIP]	2026-10-09 03:08:54 +08:00
justme	7ff03a9628	fix(display): a hovered card no longer covers the top bar [CI SKIP]	2026-10-09 03:08:53 +08:00
justme	5dce387c87	ci: build a dev image to test automatic node updates [CI]	2026-10-09 02:10:38 +08:00
justme	535bb3517d	feat: node updates by restart, auto by default; Podman Quadlet install from the panel alongside compose [CI]	2026-10-09 01:33:22 +08:00
justme	88b1a0a9bb	feat: probe host stats, node cards with a separate lines panel grouped by carrier, Windows host sampling, manual carrier override [CI]	2026-10-08 21:56:19 +08:00
justme	bac1c27e72	fix: compose passes .env through env_file; clearer name and channel messages [CI] ... podman-compose does not substitute defaults inside "environment:" (a value like ${MOSHIRO_NAME:-} reached the node as the literal text), so the node was enrolled with an invalid name and reported the wrong network scope. The three compose files now read .env with env_file and only interpolate image and network_mode; the Backend .env keys are the container's own names (MoShiro__PublicUrl, MoShiro__ClaimCode). - The generated .env no longer carries a comment line for MOSHIRO_NAME; the dialog says how to choose a name instead. - The container entrypoint prints the name it enrolls with and defaults MOSHIRO_NETWORK_SCOPE to host (Docker Desktop sets container in .env). - The overview and line pages say "measurement channel not established" instead of "not connected": the agent can be reachable and pingable while the measurement TCP/UDP path is not.	2026-10-08 20:47:38 +08:00
justme	12be44645f	feat: install nodes and the backend from a static compose file; remove dead code [CI] ... Agent, Probe and Backend now start from one static compose.yaml plus a local .env: the panel (or the release assets, for the very first Backend) provides the file, the panel's command writes the public values into .env, checks the file's SHA-256 and runs compose up. Updating is compose pull && compose up -d. The image is chosen by the CI channel (:latest, or MOSHIRO_VERSION in .env), not by the panel; the previous one-line script stays as a fallback. - packaging/compose/{agent,probe,backend}/compose.yaml are the single source, embedded in the Backend and served at /install/compose/{file}; the root compose.yaml moved there. Releases also carry them and list them in the signed SHA256SUMS. - The container entrypoint defaults the node name to the host name. - Join token creation returns a compose block (.env, url, hash, per-platform commands); the admin dialog leads with it. - Remove code with no references (HotLayer members, LiveHub.SubscriberCount, QueryService.ParseParams, ReleaseService.Forget, a few constants) and reduce the install-code lookup to the role it is for.	2026-10-08 20:24:23 +08:00
justme	e014a19554	docs: reorganize into design, security, api, ops and dev; drop stale designs; refresh the diagrams [CI] ... - Group docs by category with an index (docs/README.md); fix every link, code comment and the protocol conformance test that read docs/protocol.md. - access.md and security.md rewritten to what is implemented: removed the unadopted member-proof chain, roles and recovery key that do not exist, the old implementation order and the budgets; gaps now carry a status. - enrollment, deployment, api: the install flow is the static, hash-checked script with environment variables; no default admin. - README and architecture: new topology and update-flow diagrams (operator passkey, CI signing, registry feed, auth and trust modules).	2026-10-08 19:37:56 +08:00
justme	636a784043	fix: the panel polls the registry for its own and the nodes' releases [CI] ... Registering a manifest with the panel is best effort in CI (an unreachable panel only warns, the pipeline stays green). The Backend update notice then never appeared, because the host updater only reads the mailbox the panel writes. A background poller now fetches the signed manifests of the agent, the probe and the backend itself from the registry every five minutes, verifies the release signature and registers them, writing the backend one into the host updater's mailbox.	2026-10-08 19:09:21 +08:00
justme	0f8f3f9a54	feat: trusted release keys setting; drop the duplicate release registration route [CI] ... The panel now lets the deployer decide which release keys it trusts. The official CI key is built in and always trusted; an own P-256 public key can be added (off by default, the private key is rejected) so manifests signed with it are accepted too. Removing it drops the manifests only it signed. Changes are audited and need update.confirm. Admin UI: System > Trust > "Trusted release keys" with a collapsible guide on generating a key pair and signing a manifest with openssl. Registration now has one path, POST /api/release/offer (no token, signature verified). The admin POST /releases route, the release.publish capability and the ci-release preset are removed.	2026-10-08 18:50:16 +08:00
justme	904ea2b0ae	refactor: remove the runtime binary binding; every release registration path verifies the CI signature [CI] ... The hash a node reports about itself cannot be trusted (a swapped binary can copy the old hash), so the runtime binding only caught files that were replaced by something that did not lie. Provenance stays where it can be verified: the signed release manifest (digest) and the signed SHA256SUMS. - Remove BinaryBindingService, the node_bindings table (schema v15 drops it), BinaryPolicy, the handshake hash/manifest fields and the admin binary column. - Drop the per-platform "binaries" list from the release manifest, the hash scripts and the updater's installed.manifest copy. - ReleaseService.PublishAsync now verifies the release signature, so the admin POST /releases route is no longer an unsigned path; tests sign with a test key. - Docs: section 16 explains why the runtime check is gone.	2026-10-08 18:30:05 +08:00
justme	a4f3d1892a	ci: all-platform node binaries in the signed release manifest; signed SHA256SUMS for the archives; web build once before the parallel backend builds; release 0.3.3 [CI SKIP]	2026-10-08 16:26:29 +08:00
justme	cab505b837	fix(ci): back to building the web apps inside the backend build; the two architectures run one after the other; release 0.3.2 [CI SKIP]	2026-10-08 16:12:59 +08:00
justme	cd9e677331	fix(ci): build the web apps once before the two backend architectures; release 0.3.1 [CI]	2026-10-08 16:05:38 +08:00
justme	879d1c8593	fix: installer checks containers only; the panel reads signed manifests from the registry when it has none; unsigned-updater nodes are labeled from the panel's manifests; sign node release images; release 0.3.0 [CI]	2026-10-08 15:59:28 +08:00
justme	4a1e48db20	test: share one operator and trust root across the trust tests; make the setup test cleanup best-effort [CI SKIP]	2026-10-08 15:30:12 +08:00
justme	f22fdf8b68	feat: first-run claim wizard (no default admin, claim code from the backend log); owner list shows account and passkey; container install first [CI]	2026-10-08 06:47:10 +08:00
justme	2ae63653c4	feat: the node itself requires an owner passkey (shared by agent and probe) and reports it; the panel derives the account and passkey it is bound to [CI]	2026-10-08 06:15:07 +08:00
justme	8c37db1577	feat: every agent and probe must have an owner passkey, enforced by the panel, the installers and fleet-enroll [CI]	2026-10-08 06:04:04 +08:00
justme	0b384a58f5	fix: hash the node binary without the registry auth file that does not exist yet [CI]	2026-10-08 05:43:51 +08:00
justme	4841f7b15b	feat: bind each node to the binary it runs at its first handshake; refuse changes that are not in a CI-signed manifest [CI]	2026-10-08 05:39:13 +08:00
justme	117d34a2af	feat: signed manifests live in the image registry; updaters and first deploys fetch and verify them without the panel [CI]	2026-10-08 05:05:13 +08:00
justme	4106f831dc	feat!: drop the backend-side elevation windows; password and passkey sessions share capabilities, passkeys guard what nodes verify; the trust page lists added and removed passkeys [CI]	2026-10-08 04:57:28 +08:00
justme	f704c66dd9	feat: CI registers release manifests without a token; the panel verifies the CI signature instead [CI]	2026-10-08 04:22:01 +08:00
justme	fbda9487d5	feat: serve the web apps from the Backend (embedded, allow-listed, no filesystem access) so passkeys bind to the panel's own domain [CI]	2026-10-08 04:09:40 +08:00
justme	4a3631f82b	fix: gate password sessions on the login method so data-source sessions also get the passkey-only page [CI SKIP]	2026-10-08 04:09:39 +08:00
justme	3b88a3419d	ci: build the dev images for the genesis-pinned trust model [CI]	2026-10-08 03:28:03 +08:00
justme	a2f88a344b	feat!: genesis-pinned operator set, server identity with an encrypted control link, key-less join codes; release key continuity ... Join codes need no passkey touch and carry only public values (genesis fingerprint, owner credentials, installer hashes). Nodes pin the genesis and owners at enrollment and only follow passkey-signed operator set versions. The panel's server key is listed in the set; pinned nodes require its signature and run the control link under AES-256-GCM. Password sessions carry no capabilities. The updater adopts a next_key from a signed manifest. Bump version to 0.2.0. [CI SKIP]	2026-10-08 03:21:44 +08:00
justme	9bb6841dce	feat: pinned agents and probes only accept peers carrying the operator's proof; the panel ships the signed operator chain with the rosters [CI SKIP]	2026-10-07 23:24:33 +08:00
justme	fc2bbdcc6d	feat: operator trust root: passkey-signed operator set, signed join codes, nodes verify and pin the chain at enrollment [CI SKIP]	2026-10-07 23:19:59 +08:00
justme	321cacac32	feat: operator trust chain library (passkey-signed operator set, grants and code-key bindings) [CI SKIP]	2026-10-07 23:09:09 +08:00
justme	36f9816f40	test: allow the installer manifest paths in the OpenAPI layout check [CI SKIP]	2026-10-07 23:02:50 +08:00
justme	310b2b5b19	feat: the one-line installer verifies the CI-signed release manifest and pulls the image by digest [CI]	2026-10-07 23:01:45 +08:00
justme	a19e6548d3	feat: trust forwarded client addresses only from configured proxies (rate limit, audit, SSE) [CI] ... Docs: access.md covers the missing node-side Backend identity and the hash-first install flow.	2026-10-07 22:51:44 +08:00
justme	ff45ad086e	feat!: sensitive actions need a fresh passkey touch (elevation windows), plus login page hint cleanup [CI]	2026-10-07 22:29:24 +08:00
justme	1379b8c7cb	feat: audit log of admin writes, sign-ins and key creation, with an audit tab [CI]	2026-10-07 22:17:52 +08:00
justme	359313a57b	feat: record who created join codes and who added each node [CI]	2026-10-07 22:12:15 +08:00
justme	6385c1b9a3	feat: sign in with a passkey (WebAuthn, ES256, discoverable credentials) and manage your passkeys [CI]	2026-10-07 21:57:19 +08:00
justme	ddb6608e32	feat!: capabilities replace API token scopes; every admin endpoint declares one, with a picker UI [CI]	2026-10-07 20:56:36 +08:00
justme	55b80f0a97	docs: access control and enrollment trust chain design [CI SKIP]	2026-10-07 20:45:23 +08:00
justme	af2962fc58	feat: one-line install for agents and probes from one shared script (curl | bash, zsh, PowerShell) [CI]	2026-10-07 20:02:38 +08:00
justme	5528753d45	feat: deploy-node.sh backend takes extra env settings with --env [CI SKIP]	2026-10-07 19:40:13 +08:00
justme	b99b95c738	feat!: pre-handshake knock on the agent TCP ports; probes get the agent certificate public key [CI]	2026-10-07 18:56:40 +08:00
justme	f03988d68b	feat: detect an agent's public IPv4 and IPv6 addresses automatically, manual values still win [CI]	2026-10-07 18:12:17 +08:00
justme	9966ea5d63	fix: run the enrollment container on the host network [CI SKIP]	2026-10-07 17:20:08 +08:00
justme	b4b50c636f	feat: deploy-node.sh also deploys the Backend and migrates old probe.json [CI SKIP]	2026-10-07 17:12:00 +08:00
justme	a9f562441f	feat!: probes generate their own keys and enroll with a join token; node and peer keys are separate [CI]	2026-10-07 16:57:34 +08:00
justme	1ff847e45a	feat: declare every protocol method's direction and enforce it in the router; add the zero-trust design [CI] ... Methods, roles and binary channels are declared in one table per plane (node and peer). RpcRouter checks direction, kind and role when handlers are registered, when messages arrive (fleet_protocol_violation, disconnect after repeated violations) and before sending. NodeConnection is split by responsibility.	2026-10-07 16:17:02 +08:00
justme	ee22309e65	fix: keep the Backend backup out of the journal [CI SKIP]	2026-10-07 15:07:39 +08:00
justme	9bcef56497	feat: daily node restart controlled from the admin, connect timings as a default line task [CI] ... Agents and Probes exit in order at a configured time (default 04:30 UTC+8, switch and time zone in the admin settings) and the service manager starts them again; a local restart_at or MOSHIRO_RESTART_AT wins. The connect kind (TCP connect and TLS handshake timings) is now a default continuous line template, with a section on the line page.	2026-10-07 14:56:50 +08:00
justme	388619b8b6	feat: add a re-runnable deploy script for container nodes and migrate listen.bind to :: [CI SKIP]	2026-10-07 14:17:50 +08:00
justme	3b73fd7474	fix: pass Backend listener port into container (#18) [CI] ... Pass the host listener URL to the Backend container process.	2026-10-07 05:17:13 +00:00
justme	e423d9b506	fix: pass Backend listener port into container [CI]	2026-10-07 13:13:21 +08:00
justme	3364f7903e	fix: bind Backend host service to its configured port (#17) [CI] ... Keep the Backend host-network container reachable on its configured port.	2026-10-07 05:11:52 +00:00
justme	4e1b372e66	fix: bind Backend host service to its configured port [CI]	2026-10-07 13:08:08 +08:00